We have two applications, each of them separated with its own backend and frontend.
The first application is the user-facing one. They register on the site and as soon as they want to execute a critical action they should be redirected to the frontend of the second application that will ask for the users personal data.
When implementing this, we proposed the following:
- On the redirect action, app1 requests app2 to "initiate a flow". This returns a token (probably jwt?).
- Now, when this redirect happens, where can I locate the jwt? I mean, if the frontend is a client-side app, wouldnt I mess it up by passing the jwt via query param? Or can I have a sort of shared cookie between different domains?
My suspicious is that I am trying to reinvent the wheel, at first I thought that using something like OAuth would work out, but the flow starts to complicate as soon as a new use case comes by and is the following:
- User registers in app1
- Wants to execute a critical action on app1, is redirected to app2
- User authenticates with app2
- Fills its information, and also "generates" new users
- These users now have to authenticate in app2 and load their information